Google PCA Practice Test 30 — 15 Questions

Question 1

A startup is deploying a microservices application on Google Kubernetes Engine (GKE) with a regional cluster. They have services that need to communicate with each other and also with external APIs. The cluster uses VPC-native routing. They have enabled Cloud NAT to allow outbound internet access for nodes without external IPs. However, the development team reports that some pods cannot reach the external APIs, while others can. All pods are in the same namespace and are not using any network policies. The pods that fail have the annotation 'cloud.google.com/gke-nat-ips' set to a list of static IP addresses. The pods that work do not have this annotation. What is the most likely cause of the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The annotation 'cloud.google.com/gke-nat-ips' is not compatible with Cloud NAT for outbound traffic.. The annotation 'cloud.google.com/gke-nat-ips' is used to assign specific static IP addresses for outbound traffic from pods, but it is only compatible with the GKE Native Networking (formerly VPC-native) and the Cloud NAT gateway when the pods use the default NAT configuration. When this annotation is set, Cloud NAT is bypassed for those pods, and the traffic is sent directly from the specified static IPs, which may not be properly routed or may be blocked by the external API's firewall rules. In contrast, pods without the annotation use Cloud NAT's dynamic IPs, which are correctly routed and allowed.

Answer

Network policies are blocking outbound traffic for those pods.

Answer

The VPC-native routing is misconfigured for the pods with the annotation.

Answer

The annotation is used to assign static IPs for inbound traffic only.

Question 2

A team uses BigQuery for real-time dashboarding. Queries on a large table take over 30 seconds. The table is date-partitioned and has high cardinality in the `user_id` column. Which optimization is MOST likely to reduce query latency?

Accepted Answer

Cluster the table on user_id. Clustering sorts data within partitions based on the clustering columns, which significantly improves query performance for filter and aggregation on those columns. `user_id` is high cardinality, so clustering on it helps. Partitioning alone is already done. Avoiding `SELECT *` helps but is not the most impactful here. Materialized views would help if the same aggregation is reused. Increasing slots costs money.

Answer

Use materialized views for all queries

Answer

Avoid using SELECT * in queries

Answer

Increase BigQuery slot reservations

Question 3

A team uses Cloud CDN to cache static assets. They update assets by deploying new versions with new URLs. However, sometimes they need to invalidate the cache for a critical fix immediately without changing the URL. What should they do?

Accepted Answer

Use cache invalidation to remove the cached objects. Cloud CDN supports cache invalidation via gcloud CLI or API. Setting short TTL reduces cache duration but not immediate. Using cache-busting (changing URL) is the recommended approach but not feasible for this immediate fix. Increasing TTL makes it worse.

Answer

Increase the TTL to max

Answer

Change the URL to a new version

Answer

Set a short TTL (e.g., 1 minute)

Question 4

A company runs a real-time data analytics platform on Google Cloud that ingests streaming data from IoT devices. The architecture uses Cloud Pub/Sub to receive messages, Dataflow for processing, and BigQuery for storage. Recently, the team noticed that the processing latency has increased significantly during peak hours. Upon investigation, they found that the Dataflow pipeline is experiencing high system lag and some workers are being killed due to out-of-memory errors. The pipeline uses a fixed window of 10 seconds and writes to BigQuery using streaming inserts. The company wants to reduce latency without sacrificing data accuracy. Which course of action should they take?

Accepted Answer

Enable Dataflow streaming engine and use exactly-once processing mode. Dataflow Streaming Engine offloads the shuffle operation to a backend service, reducing memory pressure and allowing workers to handle more data. Increasing workers (A) may help but root cause is memory. Changing windowing (B) sacrifices timeliness. Dead-letter queue (C) does not address latency.

Answer

Change the windowing to a global window and use batch inserts to BigQuery

Answer

Increase the number of Dataflow workers and machine type to handle the load

Answer

Implement a dead-letter queue for unprocessed messages and use a slower processing rate

Question 5

A company has a requirement to store application logs for 7 years for compliance. They are using Cloud Logging. What is the most cost-effective way to retain logs?

Accepted Answer

Export logs to Cloud Storage with Object Lifecycle management to delete after 7 years. Cloud Logging's default retention is limited (e.g., 30 days for logs in the default _Default bucket, and up to 365 days for custom log buckets). To meet a 7-year compliance requirement cost-effectively, you should export logs to Cloud Storage and use Object Lifecycle Management to delete objects after 7 years. Cloud Storage offers lower long-term storage costs than retaining logs in Logging's _Required or custom buckets, and lifecycle rules automate deletion without ongoing compute costs.

Answer

Set the log bucket retention to 7 years

Answer

Export logs to BigQuery and run scheduled queries to delete old data

Answer

Use Cloud Logging's default retention and rely on backups

Question 6

Your company runs a containerized microservices application on Google Kubernetes Engine (GKE) with a regional cluster. The application consists of a frontend service, a backend API service, and a background worker service that processes messages from Cloud Pub/Sub. The worker service uses a Deployment with 3 replicas. Recently, the team noticed that the worker service is frequently failing with 'ContainerCreating' errors. The error message in the pod events is: 'Failed to pull image "gcr.io/my-project/my-worker:latest": rpc error: code = DeadlineExceeded desc = context deadline exceeded'. The image is stored in Container Registry in the same project. The cluster nodes are n1-standard-2 VMs with 10 GB of disk space. The team has confirmed that the image exists and that the nodes have internet access. What is the most likely cause of the issue?

Accepted Answer

The nodes have insufficient disk space to pull the new image, causing the pull to time out.. The error 'context deadline exceeded' when pulling an image indicates that the kubelet timed out while trying to download the container image. With only 10 GB of disk space on n1-standard-2 nodes, the node's disk may be nearly full, causing the image pull to stall or fail due to insufficient space to unpack the layers. This is the most likely cause because the image exists and internet access is confirmed, ruling out authentication or connectivity issues.

Answer

The worker pods require node affinity to a specific node pool that is not configured.

Answer

The nodes do not have the necessary permissions to access Container Registry.

Answer

The cluster is a regional cluster, but the worker pods are all scheduled in the same zone, causing resource contention.

Question 7

Your company runs a stateful web application on Compute Engine instances in a managed instance group (MIG) with autoscaling based on CPU utilization. The application maintains session state in memory on each instance. Recently, users have been experiencing session timeouts and data loss during scaling events. Additionally, the application's performance degrades under load due to frequent database queries for session data. You need to design a solution that ensures session persistence, improves performance, and minimizes application changes. The application is written in Java and uses Tomcat. Which of the following should you do?

Accepted Answer

Deploy Cloud Memorystore for Redis as a session store, and configure Tomcat to use Redis-backed session persistence using the Redisson or Spring Session framework.. It introduces an external, highly available, in-memory session store (Cloud Memorystore for Redis) that decouples session state from individual Compute Engine instances. This eliminates session loss during autoscaling events and reduces database load by serving session data from fast Redis memory, all while requiring minimal application changes via Tomcat's built-in session persistence or Spring Session integration.

Answer

Rewrite the application to be stateless by moving all state to the frontend using JWT tokens, eliminating the need for server-side sessions.

Answer

Configure the load balancer to use session affinity (sticky sessions) and increase the instance size to handle more sessions per instance.

Answer

Store session data in Cloud SQL using Spring Session JDBC, and configure the application to retrieve sessions from the database.

Question 8

The firewall rule 'allow-ssh' was not created. According to the audit log, what is the most likely reason?

Accepted Answer

The user does not have the compute.firewalls.create permission.. The audit log indicates the firewall rule 'allow-ssh' was not created because the user lacks the specific permission required to create firewall rules in Google Cloud. The correct permission is `compute.firewalls.create`, which is part of the `compute.securityAdmin` role but not automatically granted with it; the `compute.securityAdmin` role includes `compute.firewalls.create`, so Option B is factually incorrect. The most likely reason is that the user does not have the `compute.firewalls.create` permission, which is a prerequisite for creating firewall rules.

Answer

The user is not authenticated.

Answer

The user has the compute.securityAdmin role but not compute.firewalls.create.

Answer

The firewall rule already exists and cannot be duplicated.

Question 9

Which THREE are best practices for managing secrets (e.g., API keys, passwords) in Google Cloud? (Select exactly 3.)

Accepted Answer

Rotate secrets regularly and automatically where possible.. Regular, automated rotation of secrets limits the window of exposure if a secret is compromised. Secret Manager supports automatic rotation policies with a rotation period and next rotation time, and can trigger a Cloud Function or Cloud Run service to generate a new secret version, ensuring secrets are rotated without manual intervention.

Answer

Encrypt secrets and store them in source code repositories.

Answer

Pass secrets as environment variables to Compute Engine instances.

Question 10

A company is designing a disaster recovery plan for a critical application running on Compute Engine with a regional persistent disk. They want to minimize recovery time objective (RTO) and recovery point objective (RPO). Which TWO strategies should they implement? (Choose two.)

Accepted Answer

Use snapshot replication to a secondary region.. Snapshot replication to a secondary region allows you to create and store disk snapshots in a different region, enabling rapid recovery of the application in that secondary region. This minimizes RTO by having the snapshots readily available for creating new disks and instances, and minimizes RPO by scheduling frequent, automated snapshots that capture incremental changes, ensuring data loss is limited to the snapshot interval.

Answer

Take manual snapshots after a failure occurs.

Answer

Create an instance template in the same region.

Answer

Store backups in Cloud Storage with a lifecycle policy.

Question 11

A company is designing a disaster recovery plan for a Cloud SQL for PostgreSQL instance. They want to failover to a different region with minimal data loss and recovery time under 10 minutes. The database is 500 GB and experiences 2,000 write transactions per second. Which solution should they use?

Accepted Answer

Create a cross-region read replica and promote it to primary during failover.. Both options B and C are valid solutions. Cloud SQL for PostgreSQL supports cross-region read replicas (also referred to as cross-region replicas) that are continuously updated via asynchronous replication. Promoting such a replica to a primary instance typically takes minutes, meeting the RTO under 10 minutes, while replication lag is usually a few seconds, meeting the requirement for minimal data loss. Option B explicitly describes creating a cross-region read replica and promoting it, which is a standard DR practice. Option C describes the same feature using the managed cross-region replication feature. Therefore, both are correct.

Answer

Export the database daily using gsutil and import in the other region using pg_restore.

Answer

Automated backups with point-in-time recovery to a new instance in the other region.

Question 12

A team is running a GKE cluster with a workload that has variable CPU and memory usage. They want to automatically adjust pod resource requests and limits based on historical usage to improve resource efficiency. Which feature should they use?

Accepted Answer

Vertical Pod Autoscaler (VPA). Vertical Pod Autoscaler (VPA) automatically adjusts CPU and memory requests and limits of pods based on historical usage, making it ideal for right-sizing. Horizontal Pod Autoscaler (HPA) scales the number of pods based on metrics, but does not modify resource requests. Cluster Autoscaler adjusts the number of nodes. PodDisruptionBudget controls pod disruptions during maintenance.

Answer

PodDisruptionBudget (PDB)

Answer

Horizontal Pod Autoscaler (HPA)

Answer

Cluster Autoscaler

Question 13

A company is migrating to Google Cloud and needs to implement a least-privilege access model. Which THREE Google Cloud services or features support this goal? (Choose three.)

Accepted Answer

Cloud IAM Conditions. Cloud IAM Conditions allow you to define and enforce attribute-based, context-aware access control policies on Google Cloud resources. By specifying conditions such as time, resource type, or IP address in IAM policies, you can grant temporary or scoped permissions, ensuring users have only the access necessary for their specific task. This directly supports least-privilege by reducing standing privileges and preventing over-permissioning.

Answer

Cloud Audit Logs

Answer

Cloud NAT

Question 14

A company has two VPC networks in the same project: vpc-a (us-central1) and vpc-b (us-east1). They want to allow communication between instances in these VPCs using internal IPs. Which action should they take?

Accepted Answer

Set up VPC Network Peering between vpc-a and vpc-b.. VPC Network Peering allows direct internal IP communication between two VPC networks, regardless of region, as long as they are in the same project or across projects. This is the simplest and most efficient method for enabling private RFC 1918 connectivity without requiring VPN tunnels or moving resources. Peering uses Google's internal infrastructure, so traffic stays within the Google network and does not traverse the public internet.

Answer

Move both VPCs to the same region.

Answer

Create a VPN tunnel between the VPCs.

Answer

Ensure firewall rules allow ingress from the other VPC's subnet ranges.

Question 15

Refer to the exhibit. The output is from `gcloud compute instances describe instance-1 --format=json`. What can you conclude from this output?

Accepted Answer

The instance is billed based on the n1-standard-2 machine type.. The output from `gcloud compute instances describe instance-1 --format=json` would include a `machineType` field that specifies the full URL of the machine type, such as `https://www.googleapis.com/compute/v1/projects/.../zones/.../machineTypes/n1-standard-2`. This confirms the instance is using the predefined n1-standard-2 machine type, which has 2 vCPUs and 7.5 GB of memory, and billing is based on that predefined type. The absence of a `custom` suffix or custom CPU/memory values in the machine type field indicates it is not a custom machine type.

Answer

The instance is using a custom machine type.

Answer

The instance is using committed use discounts.

Answer

The instance has a GPU attached.